New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Vulnerability: Local Code/OS Command Execution in Commander.js parse() Method #2110

Closed

adominguezepiuse opened this issue Dec 18, 2023 · 2 comments

adominguezepiuse commented Dec 18, 2023 •

edited by shadowspawn

Loading

Description

Collaborator

shadowspawn commented Dec 18, 2023 •

edited

Loading

Thanks for the contact, but please see https://github.com/tj/commander.js/blob/master/SECURITY.md#reporting-a-vulnerability for responsibly reporting a security vulnerability.

To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.

shadowspawn closed this as completed

Collaborator

shadowspawn commented Feb 16, 2024 •

edited

Loading

This issue was responsibly reported by the Checkmarx Application Security Research Team. It was fixed in v2.20.3 (#1074) and v3.0.2(#1056).

The Checkmarx vulnerability library lists this as: https://devhub.checkmarx.com/cve-details/Cx435a6fda-ca38/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment